Customer details are appearing in analytics URLs and event fields

Start from the surfaced value, not the report

Record the exact place the identifier appeared: the report or exploration name, the date range, and the redacted name of the field, URL pattern or event parameter that carried it. Note the category of identifier, such as an email-shaped value, a name, a phone number or an order reference, without copying the value itself. A screenshot of the report proves that something was received; it does not show which page, form or rule sent it, and treating the report as the source leads to edits in the wrong system.

Preserve the original evidence in a restricted location and use a redacted copy for any wider discussion. Google's Analytics documentation prohibits sending personally identifiable information and specifically calls out URLs, page titles and fields where users enter information as areas requiring review. That tells you the finding matters and where to look; it does not identify which of your pages is responsible. If the value must be compared with a customer record, that comparison stays inside your authorized systems and out of shared worksheets.

Reproduce the path with synthetic values

Have an authorized technical owner walk the live flow, whether that is search, filtering, account, checkout or a form submission, using an invented test value that cannot belong to a real person. Watch the browser's network activity and any tag diagnostics while the value moves. The goal is to observe the moment the synthetic value appears in a page URL, a redirect, a page title or an outgoing event parameter, and to record the exact parameter name and destination.

Common paths are worth checking without being assumed: a search or filter that echoes input into the query string, a form that appends entries to a confirmation URL, a plugin that places an address into a page title, or a tag rule that maps a form field into an event parameter. A suspected path stays a hypothesis until the synthetic value is observed traveling it. Record the page, tag version and browser conditions for each test, and list the flows you did not examine.

If the value cannot be reproduced, treat that as a finding too. The transmission may depend on an untested path, a browser extension or a configuration that has since changed. Mark the source unverified rather than guessing, and keep the original redacted finding open.

Name the emitting surface and the receiving service

Once the synthetic value is observed, identify what emitted it: a theme template, a form plugin, a search or filter module, a tag-manager rule or a custom script. Record the configuration location and its owner, because the correction happens there and not in the analytics report. Where a tag manager is involved, record the specific rule and trigger rather than the container name.

Then identify every service that received the value: the analytics property, an advertising endpoint or any other destination visible in the request. Each destination has its own owner and its own data handling. This distinction matters because correcting the emitting surface stops future transmissions, while data already received remains with each destination. Keep the list factual: destination name, an internal account reference where appropriate, and the person responsible for any follow-up.

Correct at the source and verify the change

Give the surface owner a specific change requirement: the named field or parameter must no longer carry the identifier, on the named pages, under the observed conditions. After the authorized change, repeat the synthetic test on the same paths and inspect the requests again. Record the change, its deployment reference, the verification date and any paths still untested. A passing test under stated conditions is the evidence you hold; it is not a guarantee about every visitor or browser.

Do not rely on a redaction or filter setting as the whole correction. Google's guidance places the review of URLs, titles and input fields on the sender, and a filtering feature is not a universal guarantee: it cannot fix a page that still exposes the value in its own URL, and it says nothing about data received before the change. Treat historical exposure as a separate open item with its own owner rather than closing it when the new configuration passes.

Assign the unresolved items and scope any review

Three questions usually outlive the configuration fix: which destinations received real identifiers and over what period, what each destination's current rules require of you, and whether the business has any incident or notification duties. The first is an internal records question. The second needs the current official documentation of each receiving service. The third needs qualified review; this trace identifies and stops a transmission, it does not determine breach or notification obligations.

If you want a structured look at the public surfaces involved, a Prism website-review consultation can examine the affected pages within an agreed scope. Describe the website, the research-only catalog and a redacted summary of the finding, never real customer values, recordings or account credentials. Scope, responsibilities, fees and terms are confirmed before work, and a content review is not a privacy-law opinion or an incident-response service.

Analytics data-leak trace

Complete one trace per surfaced finding. Use redacted field names, parameter names and destinations only; real customer values stay in restricted systems. An unreproduced path or an unresolved destination stays open. The final column is left for your dated record and owner.

Worksheet entries are not submitted by Prism’s worksheet and are not saved by the site. Use record types, availability, anonymized observations, or match/mismatch results. Do not enter government identifiers, customer names or addresses, customer messages, receipt-access links, card or bank details, passwords, or keys. Send sensitive documents only through the provider’s verified secure channel.

These are temporary notes. Leaving or reloading this page may clear them. Worksheet entries are not sent automatically. If you copy notes into the consultation message and submit the form, Prism receives them as part of your request.